Windows File Events: Flag Files With Double Extensions (e.g., .docx.exe)

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1036.007Double File Extension
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows file creation or rename events where the target filename matches patterns consistent with double extensions, such as ending in executable archive/document types or containing an additional extension marker (e.g., '.pdf.' or '.docx.'). Attackers use double extensions to disguise executable or risky content, taking advantage of default Windows behaviors that may hide known file extensions. The detection relies on file event telemetry that includes the full target filename, including its suffix and embedded extension-like segments, and excludes icon-path noise under '/usr/share/icons/'.

Reporting behind it

Related detections7 linkedT1036.007 — drag to rearrange

Suspicious Double Extension docx Executable Execution (via process_creation)

Suspicious MSC File with Double Extension (via file_event)

Suspicious MSHTA Execution of Polyglot PDF File Spawned by cmd (via process_creation)

Masquerading Noodlophile Payload Execution via Video File Double Extension (via process_creation)

Suspicious Double Extension PDF Executable via Process Creation

Windows Suspicious Double-Extension Execution via Parent Command Line

Windows File Creation: Suspicious LNK Double-Extension Targeted by Document/Image Prefixes

Windows File Events: Flag Files With Double Extensions (e.g., .docx.exe)

Pivot detection · T1036.007 · 7 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-file-events-suspicious-double-extension-filenames-b4926b47

title: "Windows File Events: Flag Files With Double Extensions (e.g., .docx.exe)"
id: 4575c15c-7a7a-4db0-8ac2-e0418c8f9023
related:
  - id: 1cdd9a09-06c9-4769-99ff-626e2b3991b8
    type: derived
  - id: 3215aa19-f060-4332-86d5-5602511f3ca8
    type: similar
  - id: b4926b47-a9d7-434c-b3a0-adc3fa0bd13e
    type: derived
status: test
description: This rule flags Windows file creation or rename events where the target filename matches patterns consistent with double extensions, such as ending in executable archive/document types or containing an additional extension marker (e.g., '.pdf.' or '.docx.'). Attackers use double extensions to disguise executable or risky content, taking advantage of default Windows behaviors that may hide known file extensions. The detection relies on file event telemetry that includes the full target filename, including its suffix and embedded extension-like segments, and excludes icon-path noise under '/usr/share/icons/'.
references:
  - https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/
  - https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations
  - https://www.cybereason.com/blog/research/a-bazar-of-tricks-following-team9s-development-cycles
  - https://twitter.com/malwrhunterteam/status/1235135745611960321
  - https://twitter.com/luc4m/status/1073181154126254080
  - https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites
  - https://vipre.com/blog/svg-phishing-attacks-the-new-trick-in-the-cybercriminals-playbook/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_double_extension.yml
author: Nasreddine Bencherchali (Nextron Systems), frack113, Huntrule Team
date: 2022-06-19
modified: 2026-03-31
tags:
  - attack.stealth
  - attack.t1036.007
logsource:
  category: file_event
  product: windows
detection:
  selection_gen:
    TargetFilename|endswith:
      - .exe
      - .iso
      - .rar
      - .svg
      - .zip
    TargetFilename|contains:
      - .doc.
      - .docx.
      - .gif.
      - .jpeg.
      - .jpg.
      - .mp3.
      - .mp4.
      - .pdf.
      - .png.
      - .ppt.
      - .pptx.
      - .rtf.
      - .svg.
      - .txt.
      - .xls.
      - .xlsx.
  selection_exe:
    TargetFilename|endswith:
      - .rar.exe
      - .zip.exe
  filter_icons_linux:
    TargetFilename|startswith: /usr/share/icons/
  condition: 1 of selection_* and not 1 of filter_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL